This application is based on and incorporates herein by reference Japanese Patent Application No. 2001-334364 filed on Oct. 31, 2001.
The present invention relates to an electronic control device having a control CPU and a monitoring CPU.
Because of high performance and the increased capacity of CPUs in resent years, it is possible to have various controls performed by a single control CPU. These events have led to decreases in the cost of control devices, such as engine ECUs. In such a control device having a single CPU configuration, a monitoring CPU is required for monitoring the controls. However, a stripped-down (inexpensive) CPU can satisfy the requirement for the monitoring CPU because the monitoring CPU is used exclusively for a monitoring purpose. Other controls are performed by the control CPU.
In the control device, a watchdog (WD) circuit can be used for monitoring operations of the control CPU. If a data transmission error occurs and the control CPU is reset by the WD circuit, fail-safe operations may not start immediately after the occurrence of the error.
When the error occurs, the monitoring CPU stops data transmission to the control CPU. Because the control CPU has no input from the monitoring CPU, it resets the monitoring CPU. If the data transmission error continues after resetting the monitoring CPU for several times, the control CPU stops outputting the WD pulse. Because the WD circuit has no input from the control CPU, it resets the control CPU. With this configuration, the fail-safe operations do not start at the time when the monitoring CPU is reset. In other words, the fail-safe operations do not start immediately after the occurrence of the error.
The present invention therefore has an objective to provide an electronic control device having a control CPU and a monitoring CPU wherein the control CPU is promptly reset upon an occurrence of error for the control device.
In the electronic control device of the present invention, the control CPU performs a plurality of controls. The monitoring CPU is connected with the control CPU in an intercommunicative manner and performs a monitoring operation for the control CPU. The monitoring CPU determines whether the data from the control CPU is properly received. When the data is not properly received, it resets the control CPU.
With this configuration, the control CPU is reset immediately when the improper deter reception is detected. Therefore, a proper procedure, such as a fail-safe operation, can be taken immediately when a failure occurs.